Add Authelia as Forgejo OIDC login source after stability window #4

Open

opened 2026-08-04 05:57:00 +00:00 by agent.omo · 0 comments

agent.omo commented

2026-08-04 05:57:00 +00:00

Contributor

Stable ID: FM-FORGEJO-OIDC
Source: plans/backlog.md#Authelia as a Forgejo login source; plans/DEFERRED.md#Authelia as a Forgejo login source
Source status: tracked deferred work
Disposition: open, deliberately deferred
Blocked by: Forgejo and the homeserver being stable in daily use

Scope

OIDC login source only. Do not place jo.et0.pw behind forward-auth: browser redirects would break Git HTTPS and API clients.

Work

Enable the Authelia OIDC provider wiring in heimdallr.
Register an authorization_code client with redirect URI https://jo.et0.pw/user/oauth2/authelia/callback; the existing service-account recipe does not create this grant type.
Add the Forgejo OAuth auth source using the approved one-time operational procedure.
Set services.forgejo.settings.oauth2_client.ENABLE_AUTO_REGISTRATION = true if registration remains disabled.

Acceptance

Browser login through Authelia works.
Git over HTTPS tokens, Git over SSH, and Forgejo API tokens remain usable.
Reprovisioning implications of the database-held auth source are documented.

Stable ID: FM-FORGEJO-OIDC Source: `plans/backlog.md#Authelia as a Forgejo login source`; `plans/DEFERRED.md#Authelia as a Forgejo login source` Source status: tracked deferred work Disposition: open, deliberately deferred Blocked by: Forgejo and the homeserver being stable in daily use ## Scope OIDC login source only. Do **not** place `jo.et0.pw` behind forward-auth: browser redirects would break Git HTTPS and API clients. ## Work - Enable the Authelia OIDC provider wiring in heimdallr. - Register an `authorization_code` client with redirect URI `https://jo.et0.pw/user/oauth2/authelia/callback`; the existing service-account recipe does not create this grant type. - Add the Forgejo OAuth auth source using the approved one-time operational procedure. - Set `services.forgejo.settings.oauth2_client.ENABLE_AUTO_REGISTRATION = true` if registration remains disabled. ## Acceptance - Browser login through Authelia works. - Git over HTTPS tokens, Git over SSH, and Forgejo API tokens remain usable. - Reprovisioning implications of the database-held auth source are documented.